virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-13 21:28:01 +02:00
Code Issues Releases Activity

avcodec/iff: rewrite out of bounds checking in writer

Browse Source 
Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2016-05-15 16:33:33 +02:00
parent fd4a52e4da
commit 5350e0fc97
1 changed files with 12 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libavcodec/iff.c
View File

@ -823,7 +823,7 @@ static void decode_delta_j(uint8_t *dst,
int w, int h, int bpp, int dst_size) int w, int h, int bpp, int dst_size)
{ {
int32_t pitch; int32_t pitch;
uint8_t *end = dst + dst_size, *ptr; uint8_t *ptr;
uint32_t type, flag, cols, groups, rows, bytes; uint32_t type, flag, cols, groups, rows, bytes;
uint32_t offset; uint32_t offset;
int planepitch_byte = (w + 7) / 8; int planepitch_byte = (w + 7) / 8;
@ -855,22 +855,20 @@ static void decode_delta_j(uint8_t *dst,
else else
offset = ((offset / planepitch_byte) * pitch) + (offset % planepitch_byte); offset = ((offset / planepitch_byte) * pitch) + (offset % planepitch_byte);
ptr = dst + offset;
if (ptr >= end)
return;
for (b = 0; b < cols; b++) { for (b = 0; b < cols; b++) {
for (d = 0; d < bpp; d++) { for (d = 0; d < bpp; d++) {
uint8_t value = bytestream2_get_byte(&gb); uint8_t value = bytestream2_get_byte(&gb);
if (offset >= dst_size)
return;
ptr = dst + offset;
if (flag) if (flag)
ptr[0] ^= value; ptr[0] ^= value;
else else
ptr[0] = value; ptr[0] = value;
ptr += planepitch; offset += planepitch;
if (ptr >= end)
return;
} }
} }
if ((cols * bpp) & 1) if ((cols * bpp) & 1)
@ -893,21 +891,21 @@ static void decode_delta_j(uint8_t *dst,
for (r = 0; r < rows; r++) { for (r = 0; r < rows; r++) {
for (d = 0; d < bpp; d++) { for (d = 0; d < bpp; d++) {
ptr = dst + offset + (r * pitch) + d * planepitch; unsigned noffset = offset + (r * pitch) + d * planepitch;
if (ptr >= end)
return;
for (b = 0; b < bytes; b++) { for (b = 0; b < bytes; b++) {
uint8_t value = bytestream2_get_byte(&gb); uint8_t value = bytestream2_get_byte(&gb);
if (noffset >= dst_size)
return;
ptr = dst + noffset;
if (flag) if (flag)
ptr[0] ^= value; ptr[0] ^= value;
else else
ptr[0] = value; ptr[0] = value;
ptr++; noffset++;
if (ptr >= end)
return;
} }
} }
} }